EX294 Exam Simulation — 18 Questions

Question 1

Which TWO statements about execution environments are true?

Accepted Answer

Execution environments can include both Ansible and system dependencies.. Option A is correct because an execution environment is an OCI container image that bundles the Ansible Core/ansible-runner runtime together with collections, Python libraries, and system-level dependencies (RPMs, etc.), so it can carry both Ansible and system dependencies. Option E is correct because execution environments are distributed and consumed as OCI container images (e.g., via podman or docker registries), which is the packaging format that makes them portable and reproducible. Option B is wrong because ansible-playbook can be run inside an execution environment (for example, via ansible-navigator or by invoking the container directly), so they are not incompatible. Option C is wrong because ansible-builder is only one tool for creating execution environments; they can also be built with a Containerfile/Dockerfile or other tooling. Option D is wrong because Ansible Navigator is a convenience CLI for running and inspecting execution environments, but it is not required — podman/docker or ansible-runner can use them directly.

Answer

Execution environments cannot be used with ansible-playbook directly.

Answer

Execution environments must be built using ansible-builder.

Answer

Ansible Navigator is required to use execution environments.

Question 2

An administrator is writing a playbook to manage multiple web servers. The playbook uses a variable "server_facts" which is a list of dictionaries with keys "hostname", "ip", and "status". The administrator needs to extract a list of all hostnames where status is "online". The administrator writes:

- name: Get online hosts
  set_fact:
    online_hosts: "{{ server_facts | selectattr('status', '==', 'online') | map(attribute='hostname') | list }}"

However, when running the playbook, the "selectattr" filter fails with an error: "Invalid data passed to filter". The administrator checks the structure of "server_facts" and confirms it is a list of dicts with the expected keys. What is the most likely cause of the error?

Accepted Answer

The "status" key exists but its value is not consistently a string; some entries have integer 0/1 instead of "online"/"offline".. The `selectattr` filter in Ansible uses Jinja2's `selectattr` which relies on Python's `attrgetter` and comparison operators. If the `status` key exists but its value is not consistently a string (e.g., some entries have integer 0/1 instead of 'online'/'offline'), the equality comparison `'==', 'online'` will fail because an integer cannot be compared to a string in this context, causing an 'Invalid data passed to filter' error. The administrator confirmed the structure is correct, so the issue is likely a type mismatch in the values.

Answer

The "map" filter cannot be chained with "selectattr" directly.

Answer

The "list" filter is unnecessary and causes the error.

Answer

The "selectattr" filter requires Python 3.8 or later.

Question 3

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. The command 'ansible-galaxy install -r requirements.yml --roles-path ./roles' installs roles from a requirements file into the specified roles directory. The '--roles-path' option (or '-p') sets the destination, and '-r' specifies the requirements file. This meets the requirement to install all roles into the roles directory of the current project.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 4

An administrator wants to create a custom credential type to store a third-party API key. The API key must be passed to the playbook as an environment variable `MY_API_KEY`. What is the correct Injector configuration in the custom credential type definition?

Accepted Answer

env: {MY_API_KEY: "{{ api_key }}"}. The Injector configuration for a custom credential type in Ansible Automation Platform uses the `env` key to map credential inputs to environment variables. The syntax `env: {"MY_API_KEY": "{{ api_key }}"}` correctly references the input field `api_key` using Jinja2 templating and assigns it to the environment variable `MY_API_KEY`, which the playbook can then access via `ansible_env.MY_API_KEY`.

Answer

file: {MY_API_KEY: "{{ api_key }}"}

Answer

env: {"MY_API_KEY": api_key}

Answer

extra_vars: {MY_API_KEY: "{{ api_key }}"}

Question 5

An Ansible rolling update playbook includes 'max_fail_percentage: 20'. If more than 20% of hosts fail during any batch, what happens?

Accepted Answer

The play aborts immediately. The `max_fail_percentage` parameter in Ansible's rolling update strategy defines the maximum percentage of hosts that can fail in a single batch before the playbook aborts entirely. When the failure rate exceeds this threshold, Ansible stops execution immediately to prevent cascading failures or inconsistent state across the remaining hosts.

Answer

The play pauses and waits for user input

Answer

The failed hosts are removed from inventory

Answer

The play retries failed hosts

Answer

The play continues with remaining hosts

Question 6

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

Accepted Answer

Pass the variable via --extra-vars and modify the prompt to be conditional with 'when: variable is not defined'.. Passing the variable via --extra-vars and making the prompt conditional with 'when: variable is not defined' allows the pipeline to provide the variable non-interactively. Option A is unsafe. Option B's --check mode does not solve prompts. Option C is unrelated. Option D encrypts data but does not handle prompts. Therefore, E is best.

Answer

Remove the prompt and always proceed.

Answer

Set ANSIBLE_STDOUT_CALLBACK=unixy to avoid interactive prompts.

Answer

Encrypt the confirmation in vault and include it.

Answer

Use --check mode to simulate.

Question 7

An Ansible playbook uses the "community.general" collection to manage firewall rules. The engineer wants to use a lookup plugin to fetch the current IPv4 address of a host to include in a dynamic inventory script. Which TWO of the following options correctly describe the usage of lookup plugins in Ansible?

Accepted Answer

Lookup plugins are executed on the control node and return data to the Ansible controller.. Lookup plugins in Ansible are designed to run on the control node (the machine where Ansible is executed), not on the remote host. They fetch data from external sources (e.g., files, databases, environment variables) and return that data to the Ansible controller for use in playbooks or inventory scripts. This aligns with the requirement to fetch the current IPv4 address of a host for a dynamic inventory script, as the lookup plugin can query local or network sources without needing to execute on the target host.

Answer

Lookup plugins are always executed on the remote host.

Answer

Lookup plugins must be imported using the "lookup" keyword.

Answer

The "file" lookup plugin reads the content of a file from the remote host.

Question 8

Which best practice should be followed when using Ansible to manage task execution across multiple hosts?

Accepted Answer

Ensure tasks are idempotent so they can be run multiple times without changing the system state beyond the desired state.. Idempotency is a core principle of Ansible: running the same playbook multiple times should produce the same desired state without unintended side effects. This ensures predictable, safe task execution across multiple hosts, as Ansible modules are designed to check the current state before making changes.

Answer

Use 'ignore_errors: yes' on all tasks to prevent playbook failures.

Answer

Always use serial execution to avoid race conditions.

Answer

Write tasks that rely on the previous task's output to ensure correct order.

Question 9

An administrator wants to ensure a role's tasks are executed only on certain hosts. Which approach should they use?

Accepted Answer

Use a 'when' condition in the role's tasks. Ansible's 'when' clause allows conditional execution of tasks based on variables such as inventory hostname, group membership, or custom facts. By using a 'when' condition that checks the target host's identity (e.g., 'ansible_hostname' or 'inventory_hostname'), the administrator can ensure that the role's tasks run only on specific hosts, without modifying inventory structure or using separate variable files.

Answer

Set host_vars for each target host

Answer

Set group_vars for the target group

Answer

Use tags on the role

Question 10

An Ansible playbook uses a rolling update strategy with serial: 1. After the first host is updated, the playbook stops and shows 'PLAY RECAP' with only one host. What is the most likely reason?

Accepted Answer

the inventory contains only one host. The `serial: 1` directive in Ansible limits concurrency to one host at a time, but the playbook will still process all hosts in the inventory. If the playbook stops after the first host and shows PLAY RECAP with only one host, the most likely reason is that the inventory contains only one host. With a single host, the play executes on that host and then finishes. Option B accurately identifies this scenario.

Answer

the playbook has a 'failed_when' condition that stops execution

Answer

the play uses 'delegate_to' incorrectly

Answer

the playbook does not have any task that triggers the next batch, and 'serial' only controls concurrency, not retry

Question 11

An Ansible automation is used to manage firewall rules on a set of Linux servers. The playbook defines a variable "allow_rules" as:
allow_rules:
  - proto: tcp
    dport: 80
    comment: HTTP
  - proto: tcp
    dport: 443
    comment: HTTPS

The engineer needs to use the "iptables" module to create rules. The module expects "chain" to be specified, and the engineer wants to dynamically set the chain based on the port: ports 80 and 443 go to "INPUT" chain, while others go to "FORWARD". The engineer writes a loop:
- name: Add iptables rules
  iptables:
    chain: "{{ item.dport | map('some_filter') }}"
    protocol: "{{ item.proto }}"
    destination_port: "{{ item.dport }}"
    comment: "{{ item.comment }}"
  loop: "{{ allow_rules }}"

But this fails because the chain field expects a string, not a list. The engineer realizes the map filter returns a list. Which of the following modifications correctly sets the chain based on port number?

Accepted Answer

chain: "{{ (item.dport in [80,443]) | ternary('INPUT', 'FORWARD') }}". It uses the `ternary` filter to evaluate a condition (`item.dport in [80,443]`) and return 'INPUT' if true, or 'FORWARD' if false. This produces a single string, which is exactly what the `chain` parameter expects, avoiding the list output from `map`.

Answer

chain: "{{ item.dport | regex_replace('^(80|443)$', 'INPUT') | default('FORWARD', true) }}"

Answer

chain: "{{ item.dport | select('in', [80,443]) | list | first | default('FORWARD') }}"

Answer

chain: "{{ item.dport | replace('80','INPUT') | replace('443','INPUT') | default('FORWARD') }}"

Question 12

An Ansible playbook retrieves a JSON response from an API and stores it in the variable `api_response`. The JSON structure is a list of objects, each with keys `name`, `status`, and `id`. The team needs to create a list of names for objects where status is 'active'. Which filter should be used?

Accepted Answer

{{ api_response | selectattr('status', 'equalto', 'active') | map(attribute='name') | list }}. It uses `selectattr` to filter the list of objects to only those where `status` equals 'active', then `map` to extract the `name` attribute from each filtered object, and finally `list` to convert the result into a list. This is the standard Ansible approach for filtering a list of dictionaries and extracting specific keys.

Answer

Answer

Answer

Question 13

A playbook must execute a task on a host that is not part of the inventory, such as a temporary cloud instance. The task should run on that host without modifying the inventory file. Which directive should be used?

Accepted Answer

add_host. The add_host module is designed to add hosts to the in-memory inventory at runtime, enabling tasks to run on hosts not present in the static inventory. Other directives like delegate_to, local_action, and include_vars serve different purposes and do not add hosts.

Answer

local_action

Answer

delegate_to

Answer

include_vars

Question 14

Refer to the exhibit. What is the purpose of the 'failed_when' condition?

Accepted Answer

It fails the task only if the return code is non-zero and the error does not indicate 'not installed'.. The 'failed_when' condition in Ansible allows you to define custom failure criteria for a task. In the exhibit, the condition 'failed_when: result.rc != 0 and "not installed" not in result.stderr' means the task will only be marked as failed if the return code is non-zero AND the error message does not contain the string 'not installed'. This is useful when a command returns a non-zero exit code for expected reasons (e.g., package not found), and you want to treat that as a non-failure.

Answer

It ensures the task never fails regardless of return code.

Answer

It fails the task only if the package is installed.

Answer

It fails the task if the package is not installed.

Question 15

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. Option A is correct because ansible-vault encrypts sensitive files such as variable files (for example, vars.yml or group_vars files), so secrets like passwords and API keys are stored in ciphertext rather than readable plain text, and they can be decrypted at runtime with a vault password. Option B is correct because setting no_log: true on a task suppresses logging of that task's command output and arguments, preventing sensitive values such as passwords or tokens from being written into Ansible logs or console output. Option C is incorrect because using the debug module with increased verbosity would print sensitive values such as passwords to output, which is the opposite of protecting them. Option D is incorrect because avoiding become: yes does not protect secrets; privilege escalation is unrelated to whether sensitive data is encrypted or hidden, and become is often legitimately needed for secure tasks. Option E is incorrect because storing credentials in plain text in the inventory exposes them directly and is a classic insecure practice, not a protection measure.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 16

A playbook uses the 'block' and 'rescue' keywords to handle errors. The block contains three tasks. The first task fails. What happens next?

Accepted Answer

The rescue section runs immediately after the failure.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed immediately after the failure, without running any remaining tasks in the block. This is analogous to a try-catch mechanism in programming: the block is the 'try', and the rescue is the 'catch'. Option B correctly describes this behavior.

Answer

The rescue section runs and retries the failed task.

Answer

The playbook fails with an error message.

Answer

The remaining tasks in the block run, then the rescue section runs.

Question 17

A playbook uses `{{ my_var | default('fallback') }}`. What is the effect?

Accepted Answer

If `my_var` is undefined, the expression evaluates to 'fallback'.. The `default` filter in Ansible (also known as `d()`) returns the specified fallback value only when the variable is undefined. If `my_var` is defined but empty or None, the filter returns the variable's value (empty string or None), not the fallback. This behavior is specific to the `default` filter's default mode; to also catch empty or None values, you must use `default('fallback', true)`.

Answer

If `my_var` is defined but empty, the expression evaluates to 'fallback'.

Answer

If `my_var` is defined but equal to None, the expression evaluates to 'fallback'.

Answer

The filter raises an error because 'default' is not a valid filter.

Question 18

Refer to the exhibit. An administrator runs a playbook in check mode and receives the shown output. What should be done to fix the failure while maintaining idempotency?

Accepted Answer

Add a task in the apache role to create the /var/www/html directory using the file module.. The failure in check mode indicates that the /var/www/html directory does not exist, and the apache role's copy task cannot write to it. The correct fix is to add a task in the apache role that uses the file module to create the directory with the desired state (e.g., state: directory), ensuring idempotency because the task will only create it if absent. This keeps the role self-contained and maintains idempotent behavior.

Answer

Modify the deploy role to use the force parameter when copying files.

Answer

Run the playbook without check mode to force the deployment.

Answer

Add a pre_task in the playbook to create /var/www/html before roles execute.